App Identity APIM Policy

Question

Need Azure APIM policy which satisfies the below conditions :
(1) A specific HTTP Header (ConsumerId) is used to carry the initial consumer identity
(2) If the header doesn't exist in the incoming request, the gateway sets it in the request towards the provider to the value of the "sub" claim of the received Access Token
(3) If the header exists, the gateway simply forwards it in the request to the provider

Answer 1

@Upasana Ghosh Thank you for reaching out to Microsoft Q&A. Based on my understanding, you want to add custom header ConsumerId with value of sub claim from the access token only if header does not exist.

You can use set-header policy with skip action so that it doesn't replace the existing header value and refer docs as below.

For decoding authorization token, use .AsJwt() method in Context variable and try the below snippet (based on answer shared by our PG in SO)

Policy snippet:

    <set-header name="ConsumerId" exists-action="skip">  
                <value>@{  
                    var jwt = context.Request.Headers.GetValueOrDefault("Authorization").AsJwt();  
                    return jwt?.Claims.GetValueOrDefault("sub") ?? "unknown";  
                }</value>  
            </set-header>  

I hope this answers your question and feel free to add a comment if you have any other questions. We would be happy to assist you. Please 'Accept as answer' and ‘Upvote’ if it helped so that it can help others in the community.